
APOLLO EXPERIENCE REPORT - 

LUNAR MODULE REACTION CONTROL SYSTEM 

by Chester A. Vaughan, Robert Villemarette, 

Witalij Karakulko , and Donald R. Blevins 

Manned Spacecraft Center 
Houston, Texas 77058 


NATIONAL AERONAUTICS AND SPACE ADMINISTRATION • WASHINGTON, D. C. • MARCH 1972 



1. Report No. 2. Government Accession No. 

NASA TN D-6740 

3. Recipient's Catalog No. 

4. Title and Subtitle 

APOLLO EXPERIENCE REPORT 

LUNAR MODULE REACTION CONTROL SYSTEM 

5. Report Date 

March 1972 

6, Performing Organization Code 

7. Author(s) 

Chester A. Vaughan, Robert Villemarette, 
Witalij Karakulko, and Donald R. Blevins, MSC 

8, Performing Organization Report No. 

MSC S-315 

10. Work Unit No. 

914-11-10-EP-72 

9. Performing Organization Name and Address 

Manned Spacecraft Center 
Houston, Texas 77058 

11. Contract or Grant No. 

13. Type of Report and Period Covered 

Technical Note 

12. Sponsoring Agency Name and Address 

National Aeronautics and Space Administration 
Washington, D.C. 20546 

14. Sponsoring Agency Code 

15. Supplementary Notes 


The MSC Director waived the use of the International System of Units (SI) for 
this Apollo Experience Report, because, in his judgment, use of SI Units would impair the usefulness 
of the report or result in excessive cost. 


16. Abstract 


The design, development, and qualification of the reaction control system for the Apollo lunar 
module are described in this document. The lunar module reaction control system used many 
of the components developed and qualified for the service module reaction control system. The 
system was qualified for manned flight during the unmanned Apollo 5 mission on January 22 
and 23, 1968, and has operated satisfactorily during all manned lunar module flights including 
Apollo 11, the first manned landing on the moon. 


17. Key Words (Suggested by Author(s)) 

• Rocket Engines * Propellant Systems 

• Attitude Control * Propellant Pressurization 

• Lunar Module * System Development 

• Reaction Control * Spacecraft Propulsion 

• Apollo Experience -System Cleanliness 

18. Distribution Statement 

19. Security Classif. (of this report) 

None 

20. Security Classif. (of this page) 

None 

21. No. of Pages 

23 

22. Price 

$ 3.00 


For sale by the National Technical Information Service, Springfield, Virginia 22151 














CONTENTS 


Section Page 

SUMMARY 1 

INTRODUCTION 1 

REQUIREMENTS 2 

DESIGN PHILOSOPHY 3 

DESIGN 4 

Flange Heater and Pressure Switch 5 

Installation of the System 6 

DEVELOPMENT AND CERTIFICATION 6 

Preproduction System Development Test Program 7 

Production System Development Test Program 8 

Design Verification Development Test Program 9 

Production Cluster Environmental Test Program 10 

Lunar Module Production Cluster Firing Test Program 10 

Integrated RCS/APS PA-1 Test Program 11 

In-House LM RCS Test Program 13 

Heater Integration Tests 14 

Engine Valve Temperature Tests 15 

LUNAR MODULE RCS CHECKOUT OF FLIGHT VEHICLES 15 

LUNAR MODULE RCS FLIGHT PERFORMANCE 16 

Lunar Module 1 (Apollo 5 Mission) 17 

Lunar Module 3 (Apollo 9 Mission) 18 

Lunar Module 4 (Apollo 10 Mission) 18 

Lunar Module 5 (Apollo 11 Mission) 19 

CONCLUDING REMARKS 19 

iii 



FIGURES 


Figure Page 

1 Apollo lunar module 2 

2 Reaction control system installation 3 

3 Reaction control system schematic 4 

4 Propellant manifold and distribution system schematic 5 

5 Development and flight schedule 6 

6 Engine safe operating regimes 14 


iv 


APOLLO EXPERIENCE REPORT 

LUNAR MODULE REACTION CONTROL SYSTEM 

By Chester A. Vaughan, Robert Villemarette, 
Witalij Karakulko, and Donald R. Blevins 
Manned Spacecraft Center 

SUMMARY 


The lunar module reaction control system was patterned very closely after the 
service module reaction control system. Components common to the service module 
reaction control system and the lunar module reaction control system were used where 
possible. Where components could not be common, common technology was used in the 
development of the lunar module reaction control system. The experience gained from 
Gemini missions and the command and service module reaction control systems in the 
areas of system fabrication, checkout, and testing also was applied to the lunar module 
reaction control system. The system reliability requirements were achieved through 
system and component redundancy. Two independent operational lunar module reaction 
control systems were provided. 

The development and certification consisted of nine major ground test programs: 
(1) preproduction system development, (2) production system development, (3) design 
verification development, (4) production cluster environment, (5) lunar module produc- 
tion cluster firing, (6) integrated reaction control system/ascent propulsion system 
PA-1, (7) the NASA Manned Spacecraft Center in-house lunar module reaction control 
system test, (8) heater integration, and (9) engine valve temperature. 

The checkout of the lunar module reaction control flight systems was divided into 
four basic categories of tests: (1) component, (2) module, (3) system level, and (4) ve- 
hicle integration checkout. 

The performance of the lunar module reaction control system on Apollo missions 
was satisfactory. Several minor problems occurred, but solutions were found for all 
problems encountered. 


INTRODUCTION 


The Apollo spacecraft is composed of the command module (CM), the service 
module (SM), and the lunar module (LM). In July 1961, the NASA Space Task Group 
released the first statement of work for the CM and the SM. Included in this statement 



of work was a description of the reaction control system (RCS). The experience gained 
during the initial development of the CM RCS and the SM RCS was applied in the develop- 
ment of the LM RCS; and, as a result, the qualification program was simplified greatly. 
This technical note is concerned only with the development and evolution of the LM RCS. 


REQUIREMENTS 


The Apollo missions required that the LM (fig. 1) maintain various attitudes with 
respect to its flight path and maneuver in three axes to achieve a successful manned 
lunar landing and return to the command and service module (CSM). Specifically, the 
LM was required to be stable during all phases of flight and to have three axes of trans- 
lation available for CSM separation, for CSM docking, and for various translational 
maneuvers during the lunar-orbit rendezvous. In addition, X-axis longitudinal trans- 
lation was required to provide propellant -settling thrust for the descent and ascent pro- 
pulsion systems. 


A wide spectrum of operational re- 
quirements for vehicles that varied in mass 
and moment of inertia by a factor of 10, cou- 
pled with the necessary vehicle accelera - 
tions, established a requirement for rocket 
engines capable of producing high sustained 
thrust as well as low impulse. The initial 
design criteria were to provide rocket en- 
gines of various thrust levels to satisfy the 
variety of requirements. However, a close 
examination of the rocket engine that was 
being developed for the SM RCS revealed 
that the high thrust and low total-impulse 
capabilities could satisfy all the transla- 
tional and rotational requirements of the 
LM mission. After this engine was select- 
ed, the remainder of the system was pat- 
terned very closely after the SM RCS; the 
differences were primarily in the propellant- 
load capability and system geometry as dictated by the requirements of the LM mission. 
The similarity was extended to the use of common components wherever possible. Be- 
cause of the common-use philosophy and the common -technology approach, component 
development and qualification testing for the LM RCS were simplified greatly. 

The environmental constraints for the LM RCS generally were less severe than 
those of the SM RCS; therefore, the experience gained with the SM components in the 
areas of vibration, shock, thermal vacuum, compatibility with propellant, and suscep- 
tibility to contamination could be applied directly to the LM design. Two specific areas 
in which environmental conditions differed significantly were the vibration and the cold 
soaking of the four LM engine clusters. Also, because LM propellant tanks were con- 
siderably longer than the SM tanks and the helium tanks were larger in diameter, the 
vibration test experience with the SM tanks could not be applied directly to the LM 
hardware. In these instances, the components were subjected to environmental testing 
dictated specifically by the LM environments. 



Figure 1. - Apollo lunar module. 
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DESIGN PHILOSOPHY 


To ensure reliable system performance, the design of the LM RCS was based on 
system and component redundancy — similar to the Mercury and Gemini spacecraft 
and to the Apollo CSM. Two independent and operationally identical LM RCS systems, 
each capable of providing attitude control and positive and negative longitudinal trans- 
lation, were provided (fig. 2). The RCS propellant supply (nitrogen tetroxide oxidizer 
and Aerozine-50 fuel) consisted of predetermined quantities for the lunar descent and 
ascent maneuvers. The tankage of each system was sized to contain one-half the RCS 
propellant required for descent, plus the total RCS propellant required for ascent. In 
addition, a contingency propellant supply was provided through an interconnect arrange- 
ment between the ascent propulsion system (APS) propellant tanks and the RCS mani- 
folds. The interconnect arrangement originally was meant to be used only in an 
emergency situation. However, the interconnect arrangement was used as a normal 
operating mode during the powered -ascent phase to conserve RCS propellants for dock- 
ing contingencies. 

Within each pressurization system, redundancy was used for such components as 
regulators, check valves, and explosive pressurization valves. The explosive valves 
were in a parallel configuration because the primary failure mode was in a closed posi- 
tion. The regulators were in a series arrangement because the primary failure mode 
was in an open position. The check valves were arranged in a series -parallel configu- 
ration (1) because the failure probability in 
an open or closed position was considered 
to be about equal and (2) because the weight 
penalty associated with this particular com- 
ponent was minimal. Thus, no single func- 
tional failure could impair the control of 
the spacecraft or jeopardize crew safety 
because of propellant shortage. 

The co"mmon-use philosophy was ap- 
plied throughout the system design, using 
developed CSM components wherever pos- 
sible. Whenever the component could not 
be used directly, but could be made usable 
on the LM with minor modification, a 
common-technology approach was followed. 
The manufacturer of the SM part was given 
the task of modifying his product to make it 
usable on the LM. Because this approach 
permitted the use of the same test proce- 
dures, test equipment, and personnel em- 
ployed for the SM, the resources and 
learning time required to produce a given 
piece of hardware were minimized and, 
thus, significant cost savings and increased 
confidence in reliability resulted. 



Ox. = oxidizer 


Figure 2. - Reaction control system 
installation. 
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DESIGN 




The LM RCS consisted of two independent systems, A and B. Each system pro- 
vided the vehicle with attitude control and X-axis translation when used independently. 
When used together, Z- and Y-axis translation could be obtained also. The two systems 
were identical in all respects other than the engine locations and thrust vectors. 

Each system had an independent helium -pressurization module, propellant tanks, 
and propellant manifold (fig. 3). The helium-pressurization module consisted of the 
helium storage tank, two parallel initiating explosive valves, a filter that protected the 
regulator, an orifice that acted as a damping device, a pressure regulator that reduced 
the initial storage pressure of 3000 psia to an operating level of 180 psia, a check valve 
assembly for each propellant (oxidizer and fuel) tank, and a relief valve assembly for 
each tank. The function of the check valves was to prevent backflow of fuel and oxi- 
dizer vapors, which later could condense in a common area and react to cause a local 
pressure and temperature rise. The function of the relief valves was to protect the 
propellant tanks from overpressurization in case of an increase in propellant tempera- 
ture or a regulator malfunction. Each system included a number of servicing and 
checkout test ports. 


System B 


System A 


Propellant-quantity-measuring device 
(PQMD) sensor (2) 


Note: 

Valve positions (N.O., 
normally open; N.C., 
normally closed) shown 
are for a normally operat- 
ing system only. 

® Pressure transducer 
EO PQMD 
® Filter 

Isolation valve 
CD Temperature transducer 
—3 Disconnect 
/0\ Up-thrust engine 
/F\ Forward-thrust engine 
/D\ Down-thrust engine 
I /S\ Side-thrust engine 

Crossfeed valve (2)— v 


-Helium pressure vessel (2) 


-Pressure transducer (8) 
-Helium initiating valve (4) 

-Helium filter (2) 

-Orifice (2) 

-Regulator assembly (2) 

Quad check valve (4) 

_Q-*-Test disconnect (18) 

— Pressure relief valve (4) 
Propellant tank (4) 


■D-*-Tank vent disconnect (4) 

■Q— Bleed disconnect (4) 
■£]— Fill disconnect (4) 

Main shutoff valve (4) 

■Q— Service disconnect (4) 

-r-® (P) 





The propellant tanks were of the positive -expulsion configuration. Each propel- 
lant was contained inside a Teflon bladder that was in turn placed inside a titanium 
shell. Helium gas entered the area between the titanium and the Teflon, forcing the 
propellant out of the bladder and into a perforated standpipe connected to the tank outlet 
port. 


The propellant manifold and distribution system is shown schematically in fig- 
ure 4. The position of the main, interconnect, fuel, and oxidizer valves controlled 
the propellant distribution to the engines. 

The valves were developed specifically 
for the LM RCS applications because no 
component was available that could sat- 
isfy the requirements of every location. 

Each valve was a latching solenoid type, 
which required power only for opening 
and closing. After the desired position 
was established, the poppet was held in 
position by permanent magnets. The 
valves were well suited for nominal, static 
system conditions but were underdesigned 
for dynamic conditions; therefore, the 
crewmen had to verify correct valve posi- 
tions during critical phases of flight. With 
proper crew procedures, the valves could 
be used for any dynamic environment with- 
out creating a major system problem. Figure 4. - Propellant manifold and distri- 

bution system schematic. 

In-line propellant filters originally 
were located downstream of the isolation 

valves. However, because the isolation valves were particularly sensitive to contami- 
nation (as discussed in detail later), the filters were relocated upstream as shown in 
figure 3. 

A redundant set of interconnect valves was provided. The valves ensured that, 
upon completion of the APS-interconnect operation during lunar ascent, the RCS pro- 
pellants would not be transferred to the empty APS tanks and that pressurant gas from 
the APS tanks would not be ingested into the RCS. These interconnect valves were nor- 
mally in the open position, and they were closed only if a malfunction was detected dur- 
ing the nominal APS-interconnect termination procedure. 


Engine isolation 
valves (typical) 


System A 
fuel 

System A 
main 
shutoff valves- 
System A 
oxidizer- 
To APS 
fuel tank* 



To engines 


- System B 
fuel 

■ System B 
main shutoff 
valves 

—System B oxidizer 

KTo APS 
oxidizer tank 

APS oxidizer 
interconnect 
valves 

Oxidizer crossfeed 
valve 


Flange Heater and Pressure Switch 

Two components developed specifically for use with the LM RCS engines were the 
engine flange heater and the engine chamber pressure switch. 

Engine flange heaters . - The engine flange heaters were required to maintain the 
temperature of the engine combustion-chamber flange above 120° F. This temperature 
level, which was determined during the engine -requalification program described later, 
was required to ensure safe operation of the engines with the Aerozine-50 fuel during 
all phases of the mission. Two heaters per engine were provided to ensure redundancy. 
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Both heaters were operated by the automatic system, and one heater had a manual 
on/off override. 

Engine chamber pressure switch . - The engine pressure switch was used in con- 
junction with the failure -detection system of the LM. The electrical signal from the 
guidance, navigation, and control system to the engine valves was compared electron- 
ically with the output of the pressure switch; and, if the two did not match, the engine 
failure indication was displayed to the crew. Corrective action such as engine isola- 
tion or troubleshooting in other systems then could be performed by the crew. 


Installation of the System 

The modular grouping of the propellant and helium storage components was made 
for the purpose of simplifying the checkout and repair procedures. Both operations 
could be performed "on the bench" without interfering with the overall vehicle opera- 
tions. The system was installed in two bay areas and on four outrigger booms. The 
tankage modules (helium, fuel, and oxidizer) were installed on the left- and right-hand 
sides of the LM directly above the APS tanks. The engines were installed in clusters of 
four on the outriggers, which were located around the periphery of the ascent stage at 
45° to the orthogonal (pitch and roll) axes. Two of the four engines in each cluster 
were fed from each propellant supply. 


DEVELOPMENT AND CERTIFICATION 


The development and certification of the LM RCS consisted of nine major ground 
test programs. An overall RCS development schedule that includes the time phasing of 
the various programs and of the first six flights is shown in figure 5. A brief discus- 
sion of each major test program follows. 


Task or flight 


1964 


1965 


1966 


1967 


1968 


1969 


1970 


HR -3 breadboard 
HR -3 production system 
HR -3 design verification test 
HR-1 
HR 2 

[Supplemental engine qualification) 
PA -1 (series 2) 

PA-1 (series 8) 

PA- 1 (series 1 1 and I2i 
In-house LM RCS test program 
Production cluster 
Engine/heater integration 
Engine valve high temperature 
Aerozine-50 margin tests 
Frozen propellant tests 
PR-1 cluster thermal tests 
LM-1 (Apollo 5) 

LM-3 (Apollo 9) 

LM-4 (Apollo 10) 

LM-5 (Apollo 11» 

LM-6 (Apollo 12) 

LM-7 (Apollo 13' 


llllllllllll 


illlllll 


mill 


iiiii 

iiimmii 


mil 


iiiii 


Figure 5. - Development and flight schedule. 
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Preproduction System Development Test Program 

The preproduction system development test program, or breadboard test, was 
the first test in which the proposed configuration of the LM RCS was hot fired. The 
term "configuration " is emphasized here because the geometrical configuration of the 
propellant -feed plumbing, which was the most important test item, was about the only 
aspect of the test hardware that resembled actual flight hardware. With the exception 
of the very early prototype engines, the breadboard system was composed entirely of 
commercially available industrial-type components. 

In early 1964, when the breadboard was being assembled, most flight components 
were still in early stages of development and were rather scarce. Most of the compo- 
nents were being developed under a common-usage agreement, and those few parts 
made available to the LM program were being installed on the LM-1 vehicle and on 
major test vehicles. 

The breadboard testing was conducted by the RCS engine developer between Au- 
gust 1964 and May 1965. One of the primary objectives of the test program was to in- 
vestigate the dynamic characteristics of the propellant -feed system. The maximum 
pulse -frequency requirement for the engines was 25 pulses/sec at a pulse duration of 
10 milliseconds. This high pulse frequency caused concern that the response of the 
relatively long propellant feedlines of the LM system was too slow to maintain adequate 
pressures at the engine inlets during transient flow. Other objectives were to evaluate 
propellant-manifold priming procedures and engine performance during multiengine 
firings. Another important aspect of the program was to " shake down " the new LM 
test facility and dala-acquisition equipment, which had been installed specifically for 
LM RCS development testing. 

The firing program consisted of single and multiengine firing matrices covering 
a wide range of pulse widths, pulse frequencies, and predicted flight duty cycles. The 
effects of pulse firings on the steady-state performance of another engine in the same 
system also were investigated. Almost 15 000 separate firings totaling approximately 
8000 seconds of burn time were accumulated on the eight-engine system. 

Although the breadboard configuration hardly resembled a flight system, it pro- 
vided valuable data much earlier than would have been possible if the test program had 
been dependent on the availability of flight-type hardware. The breadboard test pro- 
gram was completed almost a year before the first flight-type configuration was avail- 
able for testing. 

One of the most significant findings of the test program was that the feed- 
pressure fluctuations during the short-pulse high-frequency firing were more severe 
than had been predicted analytically, hi certain pulse modes, the transient engine - 
inlet pressures dropped to levels as low as the propellant vapor pressure, in which 
case no thrust was produced by the engine. On the other hand, peak transient pressure 
generated at engine valve closure approached the proof-pressure requirements of some 
components. 

Fortunately, the detrimental effects of these severe feed-pressure fluctuations 
were recognized in time to avoid serious effect to the LM program. This information 
led to a complete reevaluation of the control system requirements for the LM and 
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helped to define the interface between the guidance system and the RCS. The signifi- 
cant result of the reevaluation was merely a change of the maximum pulse frequency 
from 25 to 7 pulses/sec. 

Another significant conclusion from the breadboard testing was that the planned 
technique for filling or priming the propellant manifolds resulted in excessive transient 
pressures, in some cases greater than the design burst pressure for some flight com- 
ponents. The burst -pres sure requirement for most propellant-feed system components 
was 550 psia. During priming, with nominal operating tank pressures, transient pres- 
sures of almost 1100 psi were recorded. These data resulted in modification of the 
planned flight-activation procedure from priming with full system operating pressure 
to priming at tank pad pressure, before activating the helium-pressurization system. 


Production System Development Test Program 

The second major test program, the production system development test pro- 
gram, was conducted from August to November 1966, during the development of the 
LM RCS. This program was perhaps the most significant in the LM RCS development. 

The test rig was designated HR-3P. With the exception of additional instrumen- 
tation and minor modifications necessary to facilitate ground test operations, the con- 
figuration of the HR-3P test rig was almost identical to that of the RCS on LM-1, the 
first flight vehicle. 

The basic objective of the test program was to determine if the system could 
achieve fundamental design requirements. Most of the components in the test rig were 
prequalified or qualified models that had undergone extensive development tests as in- 
dividual components. However, HR-3P was the first rig that was assembled and tested 
as a complete system. 

To facilitate efficient test operations, the program was divided into a series of 
short tests, each with a specific objective relating to the various environmental or 
operational conditions that a flight system might experience during a lunar landing. 

Also, anticipated flight conditions were simulated whenever possible within the opera- 
tional limitations of the test facility and the imposed schedule requirements. All tests 
were performed at local barometric pressure, which was approximately 12. 5 psia. A 
large number of specific test objectives included the investigation of the following items. 

1. Helium -pressurization-system activation and propellant section priming 

2. System performance during simulated vehicle control modes and mission 
duty cycles 

3. The effects of high and low temperatures on the performance of the system 

4. System performance during crossfeed and simulated interconnect operation 

5. Effectiveness of system-malfunction procedures and component redundancy 
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6. Component compatibility with propellants 

7. Decontamination techniques and fluids 

The HR-3P test rig also provided valuable experience in helium and propellant 
servicing. This experience was used in the design of the spacecraft ground -support 
equipment used at the launch site. 

The firing program consisted of single and multiengine firings under nominal 
and off-nominal conditions of propellant -feed pressures, engine valve voltages, and 
propellant temperatures. Approximately 57 000 separate engine firings for a total of 
approximately 8300 seconds of burn time were accumulated on the system engines dur- 
ing the program. 

Except for the rather routine operational problems with instrumentation and sup- 
port facilities that are usually expected during a complex and large-scale test opera- 
tion, the program ran rather smoothly and was completed within a reasonable period 
of time. All test objectives were accomplished; that is, the capability of the system 
design to meet fundamental requirements was demonstrated and no insurmountable de- 
ficiencies were uncovered. The unique environment resulting from system operation 
did disclose salient characteristics of some components that were not compatible with 
all planned system operational modes. An outstanding example was the discovery that 
the propellant latching valves would unlatch and shift position when subjected to the high 
flow rates or pressure surges that occurred during initial filling or priming of the pro- 
pellant manifolds. This problem led to a very comprehensive investigation into the de- 
sign characteristics of the latching valve and revealed the true limitations of the valve. 
As mentioned previously, this valve problem was solved for flight by requiring the crew 
to ascertain correct valve positions during critical phases of flight. Other component 
problems discovered were (1) transducer diaphragm incompatibility with propellant 
combustion residuals and (2) an inadequate seal design in the ground half of the 
propellant -servicing quick-disconnect couplings. 

The test program also substantiated the contention that the contamination control 
requirements and procedures for the system were incompatible with the designs and 
reliability requirements of some components. Almost every system component and 
many facility components experienced leakage failures caused by particulate contami- 
nation. The propellant latching valve, because of a very narrow (0.006 inch) seat, was 
found to be particularly sensitive to contamination. The large number of leakage fail- 
ures caused by particulate contamination provided support for a broad-based contami- 
nation control program, which is discussed in the section of this report entitled "Lunar 
Module RCS Checkout of Flight Vehicles." 


Design Verification Development Test Program 

The third system-level test program was a design verification test (DVT) exe- 
cuted during February and March 1967. Whereas the objective of the previous produc- 
tion system test program was to determine the performance of the system under various 
conditions, the objective of the DVT program was considerably broader in scope. Not 
only was acceptable operation of the system demonstrated, but other factors such as 
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manufacturing and checkout procedures, contamination control techniques, and propel- 
lant decontamination procedures used on flight systems were verified. All components 
in the DVT system were fully qualified models and were assembled into the same con- 
figuration as that of LM-3, the first manned vehicle. Also, the DVT system underwent 
the same manufacturing and checkout operations as the flight systems. 

The DVT program was essentially a repetition of some parts of the production 
system test program. High and low propellant -temperature tests, crossfeed opera- 
tion, and simulated failure-mode operation tests were conducted. Approximately 
23 200 engine firings were made, totaling approximately 3800 seconds of engine-burn 
time. 


Production Cluster Environmental Test Program 

The production cluster environmental test program demonstrated the structural 
integrity of the engine cluster and vehicle mounting hardware. Extensive shock and 
vibration tests in all major axes were conducted on a complete production flight -type 
engine cluster and boom assembly. 

With the exception of the failure of a chamber pressure transducer bracket, the 
cluster design withstood all the mission-level random and sinusoidal vibration loads to 
which it was subjected. Overstress vibration levels of up to 200 percent of specifica- 
tion requirements also were imposed on the cluster without causing any significant 
structural failures. Failure of the transducer bracket resulted in a bracket redesign 
that was retrofitted on LM-1, the first flight vehicle. 


Lunar Module Production Cluster Firing Test Program 

The firings of a complete, flightworthy LM engine cluster (four engines) under 
simulated altitude conditions took place during the production cluster firing test pro- 
gram that was conducted in April 1966. The primary objectives of the program were 
to evaluate engine performance under more realistic flight conditions (particularly low 
ambient pressure) and to determine the heat -transfer characteristics of the cluster 
during steady-state and pulse-mode duty cycles. The thermal data were to be inte- 
grated into the cluster thermal tests that were being conducted in a thermal vacuum 
facility that simulated the space environment. 

The firing program consisted of single and multiengine firings that simulated 
selected portions of expected mission duty cycles. In all, 1807 seconds of burn time 
and approximately 8500 firings were accumulated on the four engines in the cluster. 

On April 27, 1966, during the low -temperature mission duty cycle part of the 
program, the combustion chamber of the upfiring engine was destroyed by an explosion 
that occurred during the start of a pulse. This failure resulted in the immediate ter- 
mination of the program and the initiation of an extensive failure -analysis effort. 

The analysis revealed that the failure was caused by a combination of conditions 
rather than by one single cause. The upfiring attitude of the engine, low engine tem- 
peratures, helium saturation of the propellants, short-pulse firings, and relatively 
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high test -cell ambient pressure were some factors found to contribute to the accumula- 
tion of nitrate compounds, which could cause high ignition overpressures and injector- 
manifold explosions. 

The engine failure brought about an extensive engine -requalification program but 
did not result in any engine design changes. For the CSM application, the engine was 
qualified with monomethylhydrazine fuel. For the LM application, the requalification 
was done with Aerozine- 50 because of the requirement for use of the same fuel for the 
LM RCS and APS. When the engine flange temperature was maintained above 120° F, 
engine failure was unlikely. The cluster heater design was changed to ensure 120° F 
flange temperature. 


Integrated RCS/APS PA-1 Test Program 

The PA-1 test rig was a flight-weight ascent-stage structure with only the RCS 
and APS installed. It was built principally for development testing of the APS, and the 
RCS was included primarily for evaluating the inter connect-propellant -feed mode. 

The configuration of the PA-1 RCS was similar to that of test rig HR-3P and flight 
vehicle LM-1 except that solenoid valves were installed between the propellant tanks 
and the helium module to prevent migration of propellant vapors into the regulators and 
check valves during extended downtimes. Also, additional feedline access ports were 
installed between the cluster isolation valves and the engines to aid in draining 
propellant. 

All testing was conducted at the NASA White Sands Test Facility (WSTF) during 
September and October 1966. A series of 11 runs was made under the altitude condi- 
tions (88 000 to 140 000 feet) attainable with the WSTF vacuum pumping system. Ap- 
proximately 3000 firings and 515 seconds of firing time were accumulated on 12 engines; 
the four upfiring engines were disabled to prevent possible injector-manifold explosions, 
which could occur at the relatively high test-cell pressure. The high test-cell pressure 
was not a realistic simulation of space vacuum. 

Analysis of the data indicated that neither the RCS nor the APS experienced any 
detrimental effects during the interconnect -feed operation. A very minor decrease in 
RCS engine thrust, estimated to be 1 to 2 percent, was observed while propellant was 
being supplied from the APS. This condition was attributed to slightly lower engine- 
inlet pressures resulting from increased pressure loss through the longer feedlines. 

The propellant pressure transients generated during RCS engine pulsing were found to 
have little or no influence on the performance of the APS engine. 

As in earlier system test programs, the lack of adequate contamination control 
was the only system -oriented problem that arose during the testing. Almost all the 
propellant latching valves in the system experienced internal leakage; and, before the 
testing began, all engines had to be returned to the manufacturer for cleaning. 

A demonstration test of a proposed flight procedure for venting the RCS propellant 
manifolds of the nitrogen pad pressure by opening the engine valves at high altitude was 
unsuccessful. Gross propellant leakage through either the interconnect valves or the 
main shutoff valves resulted in hot firings during the attempted manifold venting. As a 
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result of this test and numerous leakage failures of the latching valve, the LM-1 mani- 
fold venting operation was eliminated. 

The RCS testing on the PA-1 configuration was resumed with series 8, 11, and 
12 tests, starting in July 1968 and ending in May 1969. The major emphasis during 
PA-1 series 8 testing was to test the APS and RCS in support of the first manned flight 
(LM-3). The RCS engines were operated in normal-feed, crossfeed, and interconnected- 
feed modes. The systems installed in the PA-1 rig were essentially the LM-3 configu- 
ration. All tests were conducted at simulated altitude conditions. The test-cell 
pressure was maintained below the 0.2-psia red-line value based on engine test expe- 
rience; therefore, the upfiring engines could be fired. Testing consisted of base-line 
engine performance tests with various propellant -feed modes, high-altitude start test- 
ing, and selected firing matrices designed to evaluate the integration of the RCS and the 
caution and warning electronics assembly (CWEA). 

The primary conclusions from series 8 tests were as follows. 

1. The RCS performance in the various feed modes was acceptable. 

2. Safe RCS start capability and acceptable engine performance at high altitude 
(220 000 feet) were demonstrated. 

3. The NASA John F. Kennedy Space Center servicing procedures should be 
modified to include a continuous powering (open) of the main shutoff valves during 
priming of the RCS manifolds. All other priming and pressurization procedures were 
found to be acceptable. 

4. Hydraulic interactions between the APS and RCS during interconnect feed 
caused minor fluctuations in the ascent-engine chamber pressure. 

5. The integrated RCS/ CWEA performed satisfactorily. 

In series 11, RCS engines were operated in the interconnect -feed mode (APS pro- 
pellants) throughout the series to simulate the ascent portion of the lunar mission. 
Testing consisted of a shakedown firing, an off-nominal lunar-landing-mission duty 
cycle to evaluate the extent of RCS-induced fluctuations on the ascent-engine chamber 
pressure, and subsequent heat-soakback tests to simulate various failed RCS engine 
configurations. 

Series 11 testing indicated a potential problem with pressure rise of trapped pro- 
pellant in the inlet manifolds as a result of thermal soakback from a hot engine. In 
these tests, thruster-pair isolation valves were closed and the RCS heater was turned 
off after RCS firing activity. In several cases, engine heat soakback and the concomi- 
tant thermal expansion of the trapped propellants resulted in inlet pressures up to the 
maximum allowed (700 psia in this test). The rate of pressure buildup showed that 
700 psia would have been exceeded had the thruster-pair isolation valves not been 
opened for relief; consequently, the Apollo malfunction procedures incorporated pres- 
sure relief steps — firing of one of the two isolated engines after isolation of an engine 
pair. 


12 



Series 12 testing consisted basically of a shakedown firing, a simulated ullage 
burn (in support of the LM-3 APS anomaly investigations), an off-nominal lunar-landing- 
mission duty cycle (high-frequency RCS pulsing), and subsequent heat-soakback tests. 

It was concluded from series 12 testing that high-frequency pulsing (up to 11 pulses/sec) 
of the RCS does not initiate CWEA thrust chamber assembly (TCA) failure indications 
in either the normal- or interconnect -feed modes. Furthermore, high-frequency puls- 
ing of the RCS does not seriously degrade engine performance, although the effect is 
greater in the interconnect mode than in the normal-feed modes. 


In-House LM RCS Test Program 

A complete LM RCS test was conducted at the NASA Manned Spacecraft Center 
(MSC) in December 1967. The primary objectives of the test were to define the general 
operational characteristics of the LM RCS under simulated altitude conditions and to 
obtain performance data on individual subsystem components. This system test was 
the first to be conducted at simulated altitude conditions in excess of 100 000 feet. 

The test article included all qualified components except the combustion-chamber 
pressure switches. Most system components and all propellant lines had been used 
previously in tests on the HR-3 DVT system at the subcontractor's Magic Mountain 
Test Facility. The HR-3 DVT configuration was modified and updated as required to 
satisfy specific test objectives and to incorporate the latest changes to the flight sys- 
tem. The most important of these changes were as follows. 

1. Propellant-quantity-measuring devices were installed in each helium tank. 

2. One flight -type thruster heater was installed on each engine. 

3. A propellant filter was installed in each engine injector valve. 

4. A pressure switch (not flight configuration) was installed in each of 16 engine 
injector heads. 

5. Flight -type arc-suppression circuitry was installed on each engine. 

The test program included (1) pretest operations, (2) base-line performance duty 
cycles, (3) simulated LM-1 and lunar-mission duty cycles, (4) special duty cycles de- 
signed to accomplish specific test objectives and evaluate system performance when 
subjected to "worst-case" duty cycles, and (5) post-test checkout and decontamination. 

The primary objectives of the test were satisfied; that is, data on the general 
operational characteristics of the LM RCS and of the individual components were ob- 
tained. In the test program, three types of anomalies were observed. These anoma- 
lies, which were investigated and resolved, were propellant latch valve leakages, 
pressure switch failures, and engine injector cooling below the 120° F lower limit. 

The propellant latch valve leakage was found to be caused by particulate contam- 
ination; therefore, the need for system cleanliness was emphasized. The switch fail- 
ures were of two types — failed closed and failed open. The failed-closed condition 
was traced to the contamination of the switch mechanism by the semiliquid combustion 
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products. Such a failure would simply eliminate the usefulness of the switch but would 
not lead to a serious problem. The open failure was caused by a design deficiency that 
was corrected on the flight configuration. The injector cooling problem was traced to 
the engine duty cycle. The problem was resolved during later tests when it was shown 
that the normal mission duty cycles would not produce the cooling effect observed. 

Another significant finding was that, in general, the HR-3 DVT system compo- 
nents performed within specification limits after testing at the subcontractor's plant 
and storage for several months at MSC. Also, following the test program, the system 
performance was adequate to complete a subsequent test program (LM-1 anomaly inves- 
tigation) after a 4.5-month exposure to an unknown and uncontrolled concentration of 
propellants. 


Heater Integration Tests 

After the engine was requalified with Aerozine-50 fuel at 120° F flange tempera- 
ture, a complete cluster of four engines and eight engine flange heaters was subjected 
to numerous firing duty cycles. In the test program, certain combinations of short 
pulses caused the engine flange to cool faster than the heaters could warm it. In some 
cases, the cooling effect was so severe that the flange temperature dropped to below 
100° F, and an engine explosion finally resulted. Additional test runs were performed 
to identify the flange cooling regimes. It was recognized that many of the duty cycles 
tested were much more severe than the duty cycle expected in flight. However, be- 
cause the actual duty cycle in flight is highly unpredictable, it was necessary to estab- 
lish the safe operating regime. The result was a map defining safe and unsafe engine 
operating duty cycles (fig. 6). Concurrent with the engine tests, additional mission 
simulations were performed to obtain a better estimate of the flight duty cycle. As 
can be seen in figure 6, the mission operating envelope (automatic mode) was found to 
be well within the safe region. The cooling effect was not a problem in the manual 
command mode because short-pulse combinations were not possible. 



Figure 6. - Engine safe operating regimes. 
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Engine Valve Temperature Tests 

During the LM-3 mission, the temperatures recorded on the engine clusters ex- 
ceeded not only the predicted values but also the upper limit of the cluster instrumen- 
tation. A series of tests was conducted in April 1969 to define a maximum temperature 
to which the engine valves could be subjected without degradation of performance. The 
engine was tested at ever-increasing temperatures starting at 275° F and ending at 
375° F. The tests were terminated at 375° F when no degradation in performance was 
experienced. An instrumentation change (increase of upper limit to 260° from 200° F) 
also was made to accommodate the expected operating temperature of the clusters. 


LUNAR MODULE RCS CHECKOUT OF FLIGHT VEHICLES 


The checkout of the LM RCS was divided into four basic categories of tests, which 
were conducted during the various stages of vehicle buildup. These were component 
tests, module tests, system-level tests, and vehicle-integration-checkout tests. In 
general, all tests conducted on individual components at each level of checkout were 
the same. Also, most test and success criteria were patterned after the component 
predelivery acceptance tests, which were derived from the original procurement spec- 
ifications for the component. The various checkout tests performed in the course of 
the vehicle buildup provided increased confidence in the system and permitted the track- 
ing of component performance from one test to another so that any degradation could be 
detected easily. 

Component tests were conducted at two locations, at the plant of the component 
manufacturer and at the point of assembly just before installation into the vehicle. The 
preinstallation test (PIT) was essentially a repetition of the checkout by the component 
manufacturer with some of the less important tests eliminated. As the program pro- 
gressed and more experience and confidence were gained with the hardware, the scope 
of the PIT was decreased gradually; and, in some cases, the test was eliminated 
entirely. 

The PIT was informal and consisted of proof -pres sure tests, external and inter- 
nal leak tests, cleanliness verifications, and functional checks. Each test was con- 
ducted according to a test plan or test outline that did not call out each individual step 
of an operation, and these documents did not require the degree of quality control and 
inspection required by the higher level test procedures. This lack of formal test 
procedures was the most significant flaw in the PIT operation and resulted in the in- 
troduction of particulate matter into some components, rupturing of numerous helium- 
relief -valve burst disks, and shorting of position indicator switches on the propellant 
latching valve. However, the PIT did eliminate many faulty units before they could be 
installed on the vehicle. 

The second level of checkout — the module level — was conducted on assemblies 
consisting of two or more components. Interconnecting brazed joints and plumbing 
were proof and leak tested, and the standard checks on individual components were re- 
peated. The module -checkout concept increased the efficiency of the checkout opera- 
tions by substantially reducing the complexity of the procedures and the test equipment. 
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For example, the elaborate and time-consuming precautions required to prevent flexure 
of the propellant tank bladders during regulator and relief valve checkout were com- 
pletely eliminated in the helium-module checkout because this checkout was performed 
without the tankage module attached. The module-test concept also allowed flexibility 
in the checkout flow; that is, the various modules could be checked out independently 
without constraining other checkout functions. Other items checked as modules were 
cluster isolation-valve/filter assemblies and the propellant manifolds. Tankage-module 
checkout consisted of bladder leak checks, unlatch current measurement and leak tests 
of the main shutoff valves, and proof and leak tests of the brazed joints connecting the 
completely assembled and tested helium module to the tanks. Final instrumentation 
checks produced a complete tankage module ready for installation on the vehicle. 

Concurrently with tankage -module checkout, the propellant manifolds were in- 
stalled and verified clean by a liquid Freon flush. This cleanliness test was conducted 
in two stages. The first part verified the plumbing between the outlet of the tankage 
module to the inlet of the cluster filter, and the second part verified the cleanliness of 
the entire manifold up to the engine inlets. It should be pointed out that this liquid - 
flush cleanliness verification was incorporated only after a gaseous verification ap- 
proach proved to be totally inadequate. The effectiveness of the flushing procedure 
was enhanced further by simultaneous low level vibration of the plumbing. Leakage 
failures of engine valves and propellant latch valves were reduced drastically by the 
liquid-flush techniques. 

System-level tests consisted of manifold integrity tests, engine leak tests, and 
engine gas flow tests. Some helium-module components, which were susceptible to 
degradation by other functions or by time, also were retested. A rather unique test 
tool called a "calibrated feather" was used to verify, qualitatively, gas flow through 
each individual propellant orifice in the engine injector head. Until this device was 
developed, no method was available to determine if the small injector orifices were 
unobstructed. 

Vehicle integration tests, usually conducted just before vehicle shipment, verified 
the interfaces between the RCS and the other systems. Engine valve wiring and re- 
sponse, cluster heater current draw, and instrumentation were checked during the final 
phase of factory checkout. 


LUNAR MODULE RCS FLIGHT PERFORMANCE 


The LM RCS performance on all Apollo flights was satisfactory. Several minor 
problems occurred, but satisfactory solutions were found for all problems noted. The 
LM-1 and LM-3 flights indicated that the upper temperature limit of 190° F on the en- 
gine cluster was exceeded on numerous occasions with no deleterious effects. As pre- 
viously discussed, additional vendor test data demonstrated that the engine valves could 
be safely operated at a much higher temperature. Consequently, the limit was deleted 
on LM-4 and subsequent vehicles. 

Pressure switch "closed" failures occurred during the LM-3, LM-4, and LM-5 
flights, but these failures had no significant effect on the flights because the only con- 
sequence was the loss of capability to detect an engine "off" failure. The single 
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pressure switch "open" failure that occurred intermittently on LM-5 was considered to 
be a serious problem because an erroneous TCA failure indication resulted. This 
problem was solved on subsequent missions by briefing the crews about the possibility 
of an erroneous TCA flag. The switches were kept in the system primarily to aid flight 
controllers in the real-time analysis of control problems and RCS engine operation dur- 
ing the critical powered-descent mission phase. They were considered to be the best 
switches available for this function but were not as reliable as the engine. A brief dis- 
cussion of the LM RCS performance on the Apollo 5, 9, 10, and 11 missions is provided 
in the following sections. 


Lunar Module 1 (Apollo 5 Mission) 

The unmanned Apollo 5 spacecraft, including the first flight- configuration LM, was 
tested successfully in earth orbit on January 22 and 23, 1968. The primary objectives 
of the Apollo 5 mission were to flight verify the LM ascent and descent propulsion sys- 
tems and the abort staging function for manned flight. These objectives were accom- 
plished. The LM-1 RCS configuration differed from subsequent LM RCS configurations 
in several areas of feed system design and instrumentation design. 

During the mission, the RCS performance and operation were nominal until con- 
trol of the spacecraft was switched to the guidance, navigation, and control system 
after abort staging (intentional separation of the ascent and descent stages of the LM). 

At that time, the vehicle mass in the digital autopilot was configured for control of a 
two-stage, fully loaded vehicle; consequently, the system was commanded to deliver 
propellant at a rate approximately 10 000 times greater than actually required. This 
anomaly caused the RCS to operate in several off-limit conditions and resulted in fail- 
ures in the system. Within 3. 1 minutes, the system A propellant was depleted to 
27 percent, and that system was isolated to conserve propellant. System B continued 
at a rapid duty cycle until propellant depletion 5 minutes later, at which time helium 
started leaking through the collapsed system B fuel bladder. Satisfactory vehicle rates 
were restored by the system B thrust reduction (resulting from propellant depletion) 
and by the isolation of system A propellant tanks. While system B was operating with 
two-phase oxidizer and helium -ingested fuel, the quad 4 upfiring engine failed. When 
system A was reactivated, the system A main shutoff valve on the oxidizer side inad- 
vertently closed. The ascent propellant interconnect valves were later opened, return- 
ing operation of the engines to normal until the interconnect valves were closed. The 
depletion of all propellant during the last minutes of the second ascent-engine firing 
allowed the spacecraft to tumble. Each of these specific RCS anomalies (i.e., the 
bladder, the engine, and the oxidizer main shutoff valve failures) was duplicated when 
a ground test system was exposed to similar duty cycle and environmental conditions 
after the flight. 

The total propellant consumption from the RCS tanks was approximately 
600 pounds. An additional 230 pounds of propellant were used from the APS tanks during 
interconnect operations. It is estimated that the RCS engines accumulated 16 000 fir- 
ings during the mission. All inflight LM-1 RCS problems were considered to be a re- 
sult of the operational anomaly that caused the RCS to operate in severe off-limit 
conditions. Therefore, no system design changes were made as a result of these 
problems. 
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Lunar Module 3 (Apollo 9 Mission) 

The Apollo 9 mission was the second to include the LM and the first to include a 
manned LM. The successful earth-orbital mission lasted approximately 241 hours 
from launch on March 3 to splashdown on March 13, 1969. The objectives of the mis- 
sion were as follows. 

1. Evaluate LM systems performance 

2. Evaluate LM functional capability 

3. Perform selected CSM/LM operations (rendezvous and docking) 

These objectives were accomplished. 

The LM RCS performed satisfactorily throughout the mission. The only problem 
noted was a failed-closed thrust chamber pressure (TCP) switch, which was used to 
monitor the quad 4 upfiring engine. 

The total propellant consumption from the RCS tanks was approximately 
353 pounds as measured by the onboard propellant-quantity -measuring devices. An 
additional 99 pounds were used from the APS tanks during interconnect operations. It 
is estimated that the RCS engines accumulated a total of 1250 seconds "on” time and 
20 000 firings during the mission. 

A significant decrease in the natural frequency of the LM RCS fuel and oxidizer 
manifold-pressure fluctuations was noted during interconnect-feed operations associ- 
ated with the APS burn to depletion. The decrease apparently was caused by either 
free helium entering the RCS manifolds from the APS or a higher saturation level of 
APS propellant relative to RCS propellant. In any event, the condition was not detri- 
mental to RCS operation. 


Lunar Module 4 (Apollo 10 Mission) 

The Apollo 10 mission was the third to include the LM and the second to include 
a manned LM. The successful lunar-orbital mission lasted approximately 192 hours 
from launch on May 18 to splashdown on May 26, 1969. The objectives of the mission 
were to demonstrate the satisfactory performance during a manned lunar mission of 
the crew, the space vehicle, and mission support facilities and to evaluate the LM per- 
formance in the cislunar and lunar environments. These objectives were accomplished. 
The LM RCS performed satisfactorily throughout the mission. The only problem noted 
consisted of five failed-closed TCP switches. 

The total propellant consumption from the RCS tanks was approximately 
557 pounds; however, only 276 pounds of the total were used during manned operations. 
An additional 42 pounds of propellant were used from the APS tanks during interconnect 
operations. It is estimated that the RCS engines accumulated a total of 1640 seconds 
"on" time and 20 000 firings during the mission. 
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Lunar Module 5 (Apollo 11 Mission) 


The Apollo 11 mission was the fourth to include the LM and the third to include a 
manned LM. The successful lunar landing mission lasted approximately 195 hours 
from launch on July 16 to splashdown on July 24, 1969. The primary purpose of the 
mission was to perform a manned lunar landing and to return the crew safely to earth. 
This objective was accomplished. 

Performance of the LM RCS was satisfactory throughout the mission. The only 
problem noted involved two TCP switches. One of them was a failed-closed or "on" 
condition similar to the experience on previous flights. The total propellant consump- 
tion from the RCS tanks was approximately 319 pounds. An additional 69 pounds of 
propellant were used from the APS tanks during interconnect -feed operations associated 
with lunar lift-off. It is estimated that the RCS engines accumulated a total of 1060 sec- 
onds "on" time and 12 000 firings during the mission. 

During an 18-minute period just before terminal phase initiation, the quad 2 aft- 
firing engine switch failed to respond to seven consecutive minimum-impulse com- 
mands. This situation resulted in a master alarm and a TCA warning flag, which were 
reset quickly by the crew. Engine operation was nominal, and the switch failure had 
no effect on the mission. Subsequent crews were briefed that an erroneous TCA flag 
was possible and that, therefore, they should not abort unless the engine failure was 
verified by vehicle dynamics or some other means. 


CONCLUDING REMARKS 


Successful completion of the ground-test program, coupled with excellent flight 
performance of the reaction control system, proved the system to be highly reliable. 

To a large extent, this high degree of reliability can be attributed to the commonality 
philosophy applied to the command and service module and lunar module reaction con- 
trol system components. Another significant factor was the system and component 
cleanliness levels that were maintained by flushing and by providing in-line filters up- 
stream of critical components. 

The lunar module reaction control system did not experience significant design 
changes during development, qualification, or flight. This fact can be attributed pri- 
marily to application of the common-use and common -techno logy philosophy. 

The engine injector valves proved to be extremely reliable. In the total program 
(both lunar module and service module), no engine injector valve leakage, as a result 
of engine operation or malfunction (explosion), was observed. The engine isolation 
valves, which were incorporated into the system to deal with the leaking engine valves, 
thus became of little value. It was concluded that the valves were not essential to crew 
safety, and the decision was made to delete them from the system in later flights to 
realize a 25-pound weight saving. 
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